---
typeId: req
recordId: benac-auth-012
fields:
  title: Replication authentication is not content trust
  statement: Benac may authenticate replication peers or document-store endpoints,
    but replicated content shall still be subject to CID verification, signature
    verification, schema validation, conflict policy, encryption policy, and
    local trust decisions.
  rationale: An authenticated sync peer can still send incorrect, malicious,
    stale, or unauthorized data.
  verification: Replicate invalid or untrusted content from an authenticated peer
    and verify that Benac stores or rejects it according to policy without
    granting execution authority.
  testable: true
  status: draft
  area: BENAC-AUTH
  sourceDocument: /home/johnb/Downloads/benac_syrs_v0_4_integrated_authentication.md
  sourceVersion: v0.4
  sourceSections:
    - 10.2 Authentication and authority boundaries
  order: 27
---
